darkrnatter[.]link

This domain, darkrnatter.link, is under investigation for credential theft. The specific threat involves the potential compromise of user credentials through a phishing campaign. No specific brand impersonation or crypto drainer kit has been identified as of yet.

Infrastructure analysis reveals that darkrnatter.link has a VirusTotal detection score of 0/95, indicating no immediate flags from the security community. The domain is registered through NAMECHEAP and resolves to the IP address 104.21.57.84, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on November 10, 2025, and it appears on one security blocklist. It is currently listed as blocked by PhishDestroy.

The domain remains active, and while it is not flagged by VirusTotal, its presence on a security blocklist and the lack of an SSL certificate suggest a potential risk. Immediate response actions include monitoring for any suspicious activity, such as unauthorized access attempts or data exfiltration. Users should exercise caution and avoid entering any sensitive information on this domain. The remaining risk is under investigation, and further analysis is required to determine the full scope of the threat.